Check your content against UK speech law frameworks

Home / Blog / Online Safety Act Enforcement: What OFCOM Can Actually Do to Platforms

← Back to Blog

Online Safety Act Enforcement: What OFCOM Can Actually Do to Platforms

Published 9 July 2026

In early 2026, OFCOM sent a clear signal to the tech industry. It opened investigations into several platforms' compliance with the Online Safety Act 2023, issued formal information requests under sections 100 and 101, and made clear that the era of voluntary codes and self-regulation was over. A regulator with teeth had arrived.

The Online Safety Act didn't just create new criminal offences — it created a full-scale regulatory framework with enforcement powers that escalate from polite requests to existential threats. OFCOM can demand information, issue enforcement notices, impose fines of up to £18 million or 10% of a company's global annual turnover, and — at the top of the ladder — apply to court for an order blocking a platform from being accessed in the UK entirely. This guide explains each step on the ladder, what's happened since the Act came into force, and what it means for platforms and users.

Disclaimer: This is general information, not legal advice. If your platform is under OFCOM investigation, the compliance obligations are complex and fact-specific. Speak to a solicitor who specialises in tech regulation.

Jurisdiction: OFCOM's enforcement powers apply UK-wide. This article focuses on the framework as enforced in England and Wales.

OFCOM's Five-Step Enforcement Ladder 1. INFORMATION REQUEST — OFCOM demands data on compliance (ss.100-101) Failure to respond is itself an offence; false information is a criminal offence 2. ENFORCEMENT NOTICE — Requires specific action within a deadline (s.130) Failure to comply = further enforcement (escalation to step 3 or 4) 3. FINANCIAL PENALTY — Up to £18 million or 10% of global annual turnover (s.140) Whichever is HIGHER. For large platforms, 10% of global turnover can reach billions 4. BUSINESS DISRUPTION — Court order to cut off payment processors and advertisers (s.141) Banks, payment providers, and advertisers ordered to stop doing business with the platform 5. ACCESS BLOCKING — Court order to block the platform from being accessed in the UK (s.142) ISPs ordered to block access; app stores ordered to remove the app Steps 1-3 are actively in use as of mid-2026. Steps 4-5 have not yet been deployed against any platform.
The five-step enforcement ladder — from information requests to platform blocking. Steps 1-3 are active; 4-5 remain unused as of 2026.

What OFCOM Has Done So Far

The Online Safety Act came into force in phases, and enforcement has followed. From 10 March 2025, all user-to-user services were required to have completed an illegal content risk assessment. From 29 June 2026, the Crime and Policing Act 2026 extended the corporate criminal liability framework — making it easier to prosecute companies whose senior managers obstruct OFCOM investigations or knowingly allow illegal content to persist.

OFCOM has not rushed to fine platforms on day one. The first phase of enforcement has focused on information gathering: requiring platforms to submit their risk assessments, respond to detailed compliance questionnaires, and demonstrate that they understand their obligations. This is deliberate. OFCOM is building an evidence base before escalating — collecting the data that will support enforcement notices, penalties, and, if necessary, business disruption measures.

The approach mirrors how other major regulators — the FCA in financial services, Ofgem in energy — operate. The ladder is real, but most regulation happens at steps 1 and 2. The existence of steps 3 through 5 provides the leverage that makes steps 1 and 2 effective.

The Crime and Policing Act 2026 Connection

The enforcement framework exists alongside the criminal law, and the two intersect in important ways. Section 250 of the Crime and Policing Act 2026 expands corporate criminal liability to cover all criminal offences committed by senior managers — not just economic crimes. If a senior manager at a platform knowingly obstructs an OFCOM investigation, or knowingly allows illegal content to remain on the service in breach of the platform's duties, both the individual and the company could face criminal prosecution.

This is a meaningful escalation. Before the CPA 2026, prosecuting a company for a senior manager's obstruction was difficult — the "directing mind and will" test limited corporate liability to a tiny number of individuals at the very top. The CPA expands that dramatically, making it possible to hold the company criminally liable for the actions of any senior manager — not just the CEO or board.

How This Fits With Individual Criminal Offences

The platform duties enforced by OFCOM operate alongside — not instead of — the individual criminal offences in the Online Safety Act and other statutes. A platform that fails to remove illegal content faces OFCOM enforcement. The person who posted it faces criminal prosecution. They're complementary systems with different enforcers, different procedures, and different consequences.

The key individual offences that platforms must assess against include:

Online Safety Act 2023, s.179 — False Communications: Knowingly false messages intended to cause non-trivial harm. Maximum: 6 months.

Online Safety Act 2023, s.181 — Threatening Communications: Threats of death or serious harm. Maximum: 5 years.

Online Safety Act 2023, s.183 — Epilepsy Trolling: Flashing images targeting people with epilepsy. Maximum: 5 years.

Online Safety Act 2023, s.184 — Encouraging Self-Harm: Encouraging or assisting serious self-harm. Maximum: 5 years.

Communications Act 2003, s.127: Grossly offensive or menacing messages. Maximum: 6 months. Still the most commonly prosecuted online-speech offence — and still within the scope of the platform assessment duties.

Two Systems, One Act: Platforms vs Individuals PLATFORM ENFORCEMENT Enforcer: OFCOM Tool: Fines, notices, blocking orders INDIVIDUAL PROSECUTION Enforcer: Police + CPS Tool: Criminal charges, imprisonment These are COMPLEMENTARY, not alternative — both can operate simultaneously on the same content CPA 2026, s.250: Corporate criminal liability for ALL senior manager offences — bridges both systems
Platform enforcement and individual prosecution are complementary — and the CPA 2026 bridges them with expanded corporate liability.

Practical Takeaways

  1. OFCOM's enforcement is real and active. Investigations are open. Information requests are being sent. The days of voluntary codes are over. Platforms that ignore their duties do so at their peril.
  2. The ladder is designed to escalate. Most regulation happens at steps 1 and 2. But the existence of steps 3 through 5 provides the leverage. A platform that cooperates and demonstrates genuine compliance efforts is unlikely to face fines or blocking — but a platform that ignores OFCOM will find the ladder climbed quickly.
  3. The Crime and Policing Act 2026 raised the stakes. Senior managers who obstruct OFCOM investigations now face criminal liability — and so do their companies.
  4. Platform enforcement sits alongside individual prosecution. OFCOM enforces against platforms. The police and CPS enforce against individuals. Both systems operate simultaneously, and the content that triggers one often triggers the other.

Sources

UK Content Comply analyses content against 13 UK speech law frameworks in total. This article focuses on OFCOM enforcement under the Online Safety Act 2023 — for coverage of the individual criminal offences and platform duties, see our UK Speech Law resources.